diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a2239cf..fc8de50 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -46,7 +46,7 @@ jobs:
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -67,7 +67,7 @@ jobs:
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest'}}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 96c7c4d..d8d2e84 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           fetch-tags: true
@@ -50,14 +50,14 @@ jobs:
 
       - name: Authenticate to Google Cloud
         id: gcloud_auth
-        uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+        uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_ID_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
           token_format: "access_token"
 
       - name: Setup GCloud SDK
-        uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
+        uses: google-github-actions/setup-gcloud@cb1e50a9932213ecece00a606661ae9ca44f3397 # v2.2.0
 
       - name: Build
         env:
@@ -112,7 +112,7 @@ jobs:
     needs: build
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           fetch-tags: true
diff --git a/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift b/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
index d3deab2..eab01ea 100644
--- a/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
+++ b/Coder-Desktop/Coder-Desktop/Coder_DesktopApp.swift
@@ -20,6 +20,7 @@ struct DesktopApp: App {
         Window("Sign In", id: Windows.login.rawValue) {
             LoginForm()
                 .environmentObject(appDelegate.state)
+                .showDockIconWhenOpen()
         }.handlesExternalEvents(matching: Set()) // Don't handle deep links
             .windowResizability(.contentSize)
         SwiftUI.Settings {
@@ -27,6 +28,7 @@ struct DesktopApp: App {
                 .environmentObject(appDelegate.vpn)
                 .environmentObject(appDelegate.state)
                 .environmentObject(appDelegate.autoUpdater)
+                .showDockIconWhenOpen()
         }
         .windowResizability(.contentSize)
         Window("Coder File Sync", id: Windows.fileSync.rawValue) {
@@ -34,6 +36,7 @@ struct DesktopApp: App {
                 .environmentObject(appDelegate.state)
                 .environmentObject(appDelegate.fileSyncDaemon)
                 .environmentObject(appDelegate.vpn)
+                .showDockIconWhenOpen()
         }.handlesExternalEvents(matching: Set()) // Don't handle deep links
     }
 }
diff --git a/Coder-Desktop/Coder-Desktop/VPN/VPNService.swift b/Coder-Desktop/Coder-Desktop/VPN/VPNService.swift
index de8fa86..9da39d5 100644
--- a/Coder-Desktop/Coder-Desktop/VPN/VPNService.swift
+++ b/Coder-Desktop/Coder-Desktop/VPN/VPNService.swift
@@ -185,10 +185,12 @@ extension CoderVPNService {
         // Any -> Disconnected: Update UI w/ error if present
         case (_, .disconnected):
             connection.fetchLastDisconnectError { err in
-                self.tunnelState = if let err {
-                    .failed(.internalError(err.localizedDescription))
-                } else {
-                    .disabled
+                Task { @MainActor in
+                    self.tunnelState = if let err {
+                        .failed(.internalError(err.localizedDescription))
+                    } else {
+                        .disabled
+                    }
                 }
             }
         // Connecting -> Connecting: no-op
diff --git a/Coder-Desktop/Coder-Desktop/Views/Util.swift b/Coder-Desktop/Coder-Desktop/Views/Util.swift
index 69981a2..10d0747 100644
--- a/Coder-Desktop/Coder-Desktop/Views/Util.swift
+++ b/Coder-Desktop/Coder-Desktop/Views/Util.swift
@@ -44,3 +44,26 @@ public extension View {
         }
     }
 }
+
+@MainActor
+private struct ActivationPolicyModifier: ViewModifier {
+    func body(content: Content) -> some View {
+        content
+            // This lets us show and hide the app from the dock and cmd+tab
+            // when a window is open.
+            .onAppear {
+                NSApp.setActivationPolicy(.regular)
+            }
+            .onDisappear {
+                if NSApp.windows.filter { $0.level != .statusBar && $0.isVisible }.count <= 1 {
+                    NSApp.setActivationPolicy(.accessory)
+                }
+            }
+    }
+}
+
+public extension View {
+    func showDockIconWhenOpen() -> some View {
+        modifier(ActivationPolicyModifier())
+    }
+}
diff --git a/scripts/update-cask.sh b/scripts/update-cask.sh
index c72f59b..770e820 100755
--- a/scripts/update-cask.sh
+++ b/scripts/update-cask.sh
@@ -100,7 +100,7 @@ cask "coder-desktop" do
 
   zap delete: [
         "/var/root/Library/Application Support/com.coder.Coder-Desktop/coder-darwin-arm64",
-        "/var/root/Library/Application Support/com.coder.Coder-Desktop/coder-darwin_amd64",
+        "/var/root/Library/Application Support/com.coder.Coder-Desktop/coder-darwin-amd64",
         "/var/root/Library/Containers/com.Coder-Desktop.VPN/Data/Documents/coder-vpn.dylib",
       ],
       trash:  [